text: It seems you're trying to PAC learn a language by only seeing positive examples.  This is called "learning from positive examples (only)."  But you also have the power to get some of your own made-up examples labeled: if the oracle were fully truthful, then these would be membership queries, so your model would be known as "learning from positive examples and membership queries."  In this framework, there are some results - for example, tree languages are learnable (not secure).  DFA are not due to crypto hardness results. (Also see this.)
  
  Of course, your setting isn't quite this.  Your membership queries are more limited.  It seems that then the known intractability results would transfer to your setting from the model I described, but the learnability results would leave you with some work to do.  But Mr. X's scheme is secure or not depending on the "pattern" he uses.
  
  Also - it seems like a strange requirement to be able to prove "Mr. X's passwords are inherently unpredictable."  Isn't it usually enough to just be able to generate a new valid password to break such a system? But this seems to be the query to Mr. Y's algorithm itself...